S3 最小权限原则

1.只读下载对象 ✅ 读取对象 ✅{ Version: 2012-10-17, Statement: [ { Sid: ReadObjectsOnly, Effect: Allow, Action: [ s3:GetObject ], Resource: [ arn:aws-cn:s3:::cc-cn-nx-s3-b40/* ] } ] }2.只允许读取 artifacts/ 目录cc-cn-nx-s3-b40 ├── artifacts/ │ ├── server │ └── config.ini ├── logs/ ├── static/ └── backup/{ Version: 2012-10-17, Statement: [ { Sid: ReadArtifactsOnly, Effect: Allow, Action: [ s3:GetObject ], Resource: [ arn:aws-cn:s3:::cc-cn-nx-s3-b40/artifacts/* ] } ] }3. 如果希望“查看桶里的文件列表”{ Version: 2012-10-17, Statement: [ { Sid: ListBucket, Effect: Allow, Action: [ s3:ListBucket ], Resource: [ arn:aws-cn:s3:::cc-cn-nx-s3-b40 ] } ] }4.最实用的“只读权限”能查看桶里的文件 能下载文件但不能修改。查看目录 ✅ 查看对象 ✅ 下载对象 ✅{ Version: 2012-10-17, Statement: [ { Sid: ListBucket, Effect: Allow, Action: [ s3:ListBucket, s3:GetBucketLocation ], Resource: [ arn:aws-cn:s3:::cc-cn-nx-s3-b40 ] }, { Sid: ReadObjects, Effect: Allow, Action: [ s3:GetObject ], Resource: [ arn:aws-cn:s3:::cc-cn-nx-s3-b40/* ] } ] }5. 如果希望“写入 S3”下载 ❌ 列目录 ❌ 删除 ❌{ Version: 2012-10-17, Statement: [ { Sid: WriteObjectsOnly, Effect: Allow, Action: [ s3:PutObject ], Resource: [ arn:aws-cn:s3:::cc-cn-nx-s3-b40/* ] } ] }6.如果只允许写日志目录{ Version: 2012-10-17, Statement: [ { Sid: WriteLogsOnly, Effect: Allow, Action: [ s3:PutObject ], Resource: [ arn:aws-cn:s3:::cc-cn-nx-s3-b40/logs/* ] } ] }7. 如果希望“读取 写入”列文件 ✅下载 ✅上传 ✅{ Version: 2012-10-17, Statement: [ { Sid: ListBucket, Effect: Allow, Action: [ s3:ListBucket, s3:GetBucketLocation ], Resource: [ arn:aws-cn:s3:::cc-cn-nx-s3-b40 ] }, { Sid: ReadWriteObjects, Effect: Allow, Action: [ s3:GetObject, s3:PutObject ], Resource: [ arn:aws-cn:s3:::cc-cn-nx-s3-b40/* ] } ] }8. 如果还希望可以删除{ Version: 2012-10-17, Statement: [ { Sid: ListBucket, Effect: Allow, Action: [ s3:ListBucket, s3:GetBucketLocation ], Resource: [ arn:aws-cn:s3:::cc-cn-nx-s3-b40 ] }, { Sid: ReadWriteDeleteObjects, Effect: Allow, Action: [ s3:GetObject, s3:PutObject, s3:DeleteObject ], Resource: [ arn:aws-cn:s3:::cc-cn-nx-s3-b40/* ] } ] }9. 如果只想查看 artifacts/而不是整个 Bucket{ Version: 2012-10-17, Statement: [ { Sid: ListArtifactsOnly, Effect: Allow, Action: [ s3:ListBucket ], Resource: [ arn:aws-cn:s3:::cc-cn-nx-s3-b40 ], Condition: { StringLike: { s3:prefix: [ artifacts, artifacts/* ] } } }, { Sid: ReadArtifactsOnly, Effect: Allow, Action: [ s3:GetObject ], Resource: [ arn:aws-cn:s3:::cc-cn-nx-s3-b40/artifacts/* ] } ] }S3创建生命周期server v1 ↓ 上传新版本 server v2 ← 当前版本保留 │ server v1 ← 非当前版本 │ └── 90天后自动删除 CC-S3-Rule 范围 整个 Bucket 当前版本 非当前版本 90 天后永久删除 ✅ 过期删除标记 清理 ✅ 未完成分段上传 7 天后删除 ✅